<html>
<head><meta charset="utf-8"><title>New Rust-related paper · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html">New Rust-related paper</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="246270736"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246270736" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246270736">(Jul 16 2021 at 19:55)</a>:</h4>
<p>Spotted this preprint that might be of interest: "Is Rust Used Safely by Software Developers?" <a href="https://arxiv.org/abs/2007.00752">https://arxiv.org/abs/2007.00752</a></p>
<blockquote>
<p>Furthermore, we recommend changes to the Rust compiler and to the central Rust repository's interface to help Rust software developers be aware of when their Rust code is unsafe.</p>
</blockquote>



<a name="246276197"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246276197" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246276197">(Jul 16 2021 at 20:44)</a>:</h4>
<blockquote>
<p>We conclude that although the use of the keyword unsafe is limited, the propagation of unsafeness offers a challenge to the claim of Rust as a memory-safe language.</p>
</blockquote>
<p>ugh, no, that's not what the claim means</p>



<a name="246276210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246276210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246276210">(Jul 16 2021 at 20:45)</a>:</h4>
<p>(but I haven't read the actual paper yet)</p>



<a name="246283986"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246283986" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246283986">(Jul 16 2021 at 21:42)</a>:</h4>
<p>Based on the findings described in the introduction, I disagree with the main claims (and research methodology, to some extent).</p>
<blockquote>
<p>RQ2: How much of the Rust code is Unsafe Rust?<br>
Unsafe Rust is necessary, but undermines the memory-safety and data-race freedom guarantees. Since Unsafe Rust may modify an arbitrary memory location, any use of Unsafe Rust in any dependency compromises the static guarantees of the whole library. Rust libraries that do not contain Unsafe Rust operations, but call functions from external libraries that do, appear Safe Rust, but, in fact, are not statically guaranteed safe. The goal of RQ2 is to determine what percentage of the Rust libraries lack full safety compiler guarantees.</p>
</blockquote>
<p>Unsafe Rust may not modify arbitrary memory locations, that's the point. Certainly the compiler has limitations in what it can check, because it's not a proof language and it can't solve the halting problem. But this idea that any crate internally using unsafe code infects all its dependencies with unsafety is definitely the wrong way to analyze the situation. In fact I'm surprised by that metric that they don't get closer to 100% of crates using unsafe, since std uses unsafe and most crates depend on it. And of course intrinsics are unsafe.</p>



<a name="246284477"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246284477" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246284477">(Jul 16 2021 at 21:46)</a>:</h4>
<p>An <em>unsound</em> crate will infect all its users with unsafety but it's pretty hard to get statistics on how many crates in the wild are unsound. At least, this is mostly considered a bug and it's not hard to push through PRs that make sure to mark public functions with safety conditions as <code>unsafe</code></p>



<a name="246284536"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246284536" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246284536">(Jul 16 2021 at 21:47)</a>:</h4>
<p>that sounds basically like <a href="https://crates.io/crates/cargo-geiger">cargo-geiger</a>, which also exempts the standard library</p>



<a name="246284963"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246284963" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246284963">(Jul 16 2021 at 21:51)</a>:</h4>
<p>The thing that bugs me about cargo-geiger's approach is that even if I have a library with unsafe and formally prove its correctness, it's still considered a dangerous crate and anyone who uses my library is similarly marked as dangerous. There is no space in this worldview for <em>encapsulated</em> unsafety</p>



<a name="246285038"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246285038" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246285038">(Jul 16 2021 at 21:52)</a>:</h4>
<p>yep</p>



<a name="246330475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246330475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> XAMPPRocky <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246330475">(Jul 17 2021 at 15:42)</a>:</h4>
<p>I read this paper the other day, I remember when this subject has come up before people were suggesting maybe renaming <code>unsafe</code> to something else to better convey the concept, and after reading this I wondered if anyone suggested <code>relaxed</code> as an alternative to <code>unsafe</code>?</p>
<p>It might be more clear that it doesn’t make code unsafe, but instead removes or “relaxes” some of the rules. It can also be thought of as telling the compiler, “Relax, I know what I’m doing”. 😄</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="k">const</span><span class="w"> </span><span class="n">relaxed</span><span class="w"> </span><span class="k">fn</span> <span class="nf">read</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="p">(</span><span class="n">src</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w">  </span>-&gt; <span class="nc">T</span><span class="p">;</span><span class="w"></span>

<span class="kd">let</span><span class="w"> </span><span class="n">value</span>: <span class="kt">u8</span> <span class="o">=</span><span class="w"> </span><span class="n">relaxed</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">std</span>::<span class="n">ptr</span>::<span class="n">read</span><span class="p">(</span><span class="mh">0x00</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
</code></pre></div>



<a name="246331134"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246331134" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246331134">(Jul 17 2021 at 15:57)</a>:</h4>
<p><code>unchecked</code> would be a better name IMHO. This is already used in the name of various unsafe functions and clearly explains that rustc doesn't check some things when using this.</p>



<a name="246335486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246335486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246335486">(Jul 17 2021 at 17:46)</a>:</h4>
<p>I agree that <code>unchecked</code> fits the meaning.</p>



<a name="246335498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246335498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246335498">(Jul 17 2021 at 17:47)</a>:</h4>
<p>So does <code>trusted</code>, but it has too positive a connotation outside of computer security.</p>



<a name="246336138"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246336138" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246336138">(Jul 17 2021 at 18:02)</a>:</h4>
<p><code>relaxed</code> doesnt sound good IMO, the rules arent relaxed -- you just have to ensure them yourself with much less compiler help</p>



<a name="246337486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246337486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246337486">(Jul 17 2021 at 18:36)</a>:</h4>
<p>I think <code>unchecked</code> is heading in the right direction, but even that is misleading. It still performs all of the normal checks, but also enables additional functionality that can't be checked.</p>



<a name="246337489"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246337489" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> XAMPPRocky <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246337489">(Jul 17 2021 at 18:36)</a>:</h4>
<p>Unchecked is also nice</p>



<a name="246337572"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246337572" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> XAMPPRocky <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246337572">(Jul 17 2021 at 18:38)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I mean I would consider that a definition of a relaxed rule, something that’s up to you to uphold.</p>



<a name="246337676"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246337676" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246337676">(Jul 17 2021 at 18:42)</a>:</h4>
<p>even <code>unchecked</code> isn't perfect, because it might feed the misconception that <code>unsafe</code> "turns off" safety checks, e.g. turning off the borrow checker</p>



<a name="246337716"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246337716" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246337716">(Jul 17 2021 at 18:42)</a>:</h4>
<p>Maybe it could be described as something like a <code>critical</code> section, since part of the idea is that extra scrutiny is required.</p>



<a name="246338116"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246338116" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246338116">(Jul 17 2021 at 18:52)</a>:</h4>
<p>critical section kind of already has another meaning though.</p>



<a name="246338333"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246338333" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246338333">(Jul 17 2021 at 18:56)</a>:</h4>
<p>Yeah, I was kind of trying to lean on that, but it's not a great match. Maybe there's a synonym along those lines though?</p>



<a name="246339321"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246339321" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246339321">(Jul 17 2021 at 19:14)</a>:</h4>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">trustmeferris</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="n">v</span><span class="p">.</span><span class="n">set_len</span><span class="p">(</span><span class="mi">0</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="246339436"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246339436" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246339436">(Jul 17 2021 at 19:17)</a>:</h4>
<p>you want to express that the code is delicate and potentially explosive, so clearly <code>volatile</code> is the proper keyword</p>



<a name="246339463"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246339463" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246339463">(Jul 17 2021 at 19:18)</a>:</h4>
<p><code>delicate</code>...</p>



<a name="246339801"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246339801" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246339801">(Jul 17 2021 at 19:25)</a>:</h4>
<p>It is mildly unfortunate that unsafe using and unsafe declaring use the same keyword, but that's not the fatal flaw of the paper, or of anyone who thinks along the same lines.</p>



<a name="246339860"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246339860" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246339860">(Jul 17 2021 at 19:26)</a>:</h4>
<p>The flaw is the absolute lack of belief in the possibility of encapsulating unsafe operations with a safe interface</p>



<a name="246340405"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246340405" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246340405">(Jul 17 2021 at 19:39)</a>:</h4>
<p>I don't think there's any problem with <code>unsafe</code> as applied to functions. it's unsafe blocks that could be more clear, and could be a totally separate keyword (although I'm not sure if a different keyword would actually overcome the misconceptions people have)</p>



<a name="246341518"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246341518" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246341518">(Jul 17 2021 at 20:03)</a>:</h4>
<p><span class="user-mention silent" data-user-id="219696">XAMPPRocky</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/New.20Rust-related.20paper/near/246337572">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> I mean I would consider that a definition of a relaxed rule, something that’s up to you to uphold.</p>
</blockquote>
<p>well, the static rules are relaxed, but the UB rules are not -- and thinking that "UB is okay in unsafe blocks" is something I've seen in the wild</p>



<a name="246341526"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246341526" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246341526">(Jul 17 2021 at 20:03)</a>:</h4>
<p><span class="user-mention silent" data-user-id="256342">bstrie</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/New.20Rust-related.20paper/near/246337676">said</a>:</p>
<blockquote>
<p>even <code>unchecked</code> isn't perfect, because it might feed the misconception that <code>unsafe</code> "turns off" safety checks, e.g. turning off the borrow checker</p>
</blockquote>
<p>it turns off the checjs that reject raw ptr derefs and things like that -- sounds unchecked to me. but I see what you mean.</p>



<a name="246341701"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246341701" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246341701">(Jul 17 2021 at 20:07)</a>:</h4>
<p>A check implies that some sort of test happens and the test result affects the code flow. index out of bounds and panic, or whatever. unchecked means the test is removed and assumed to have passed.</p>
<p>So from that point of view, raw pointers needing an unsafe block isn't "checked". There's no check that occurs before reading the pointer if the check passed.</p>



<a name="246342310"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246342310" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246342310">(Jul 17 2021 at 20:22)</a>:</h4>
<p>a check can be many things. does not have to be at runtime. there's a check rejecting raw ptr deref. <span aria-label="shrug" class="emoji emoji-1f937" role="img" title="shrug">:shrug:</span><br>
(IOW, I dont accept your narrow definition of "check".)</p>



<a name="246343334"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246343334" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Chris Denton <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246343334">(Jul 17 2021 at 20:51)</a>:</h4>
<p>From the point of view of the programmer, if I use an <code>unsafe</code> block but don't use any unsafe operations or functions then it's exactly the same as not using <code>unsafe</code> at all (i.e. it's unnecessary unsafe). So it doesn't "turn off" anything in that sense. It just gives me "super powers" (as <a href="https://doc.rust-lang.org/stable/book/ch19-01-unsafe-rust.html#unsafe-superpowers">the book</a> puts it) which allows me to use operations that are otherwise completely forbidden in safe code.</p>



<a name="246343599"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246343599" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246343599">(Jul 17 2021 at 20:59)</a>:</h4>
<div class="codehilite"><pre><span></span><code>superrust { ... }
</code></pre></div>
<p>:D</p>



<a name="246345179"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246345179" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Poliorcetics <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246345179">(Jul 17 2021 at 21:20)</a>:</h4>
<p>Too long a keyword for Rust, « sprust » maybe <span aria-label="stuck out tongue closed eyes" class="emoji emoji-1f61d" role="img" title="stuck out tongue closed eyes">:stuck_out_tongue_closed_eyes:</span> ?</p>



<a name="246345210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246345210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246345210">(Jul 17 2021 at 21:22)</a>:</h4>
<p><code>rust++ { }</code>, obviously</p>



<a name="246345452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246345452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246345452">(Jul 17 2021 at 21:28)</a>:</h4>
<p>We already have <code>extern "Rust" { }</code> for declarations, I don't see why we couldn't allow definitions/expressions within and make up a rust++ "CC".</p>



<a name="246345533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246345533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246345533">(Jul 17 2021 at 21:31)</a>:</h4>
<p>or rather just rename to rust++ and allow plain old rust in <code>extern "Rust"</code> blocks.</p>



<a name="246346918"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246346918" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246346918">(Jul 17 2021 at 22:08)</a>:</h4>
<p>though that sounds dangerously like saying unsafe Rust is the better Rust^^</p>



<a name="246348245"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246348245" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246348245">(Jul 17 2021 at 22:49)</a>:</h4>
<p><code>super</code> is already a keyword...</p>



<a name="246348364"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246348364" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246348364">(Jul 17 2021 at 22:52)</a>:</h4>
<p><code>super {}</code>, <code>super fn foo() {}</code>, <code>pub(super) super fn bar() {}</code>, ...</p>



<a name="246428414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246428414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246428414">(Jul 19 2021 at 08:27)</a>:</h4>
<p><a href="https://xkcd.com/149/">https://xkcd.com/149/</a></p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">sudo</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="o">*</span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">23</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="246474120"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246474120" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246474120">(Jul 19 2021 at 15:58)</a>:</h4>
<p>i shuddered when i read this but perhaps it was unrelated...</p>



<a name="246474194"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246474194" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246474194">(Jul 19 2021 at 15:58)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/New.20Rust-related.20paper/near/246346918">said</a>:</p>
<blockquote>
<p>though that sounds dangerously like saying unsafe Rust is the better Rust^^</p>
</blockquote>
<p>in what world would Rust++ not be a better rust (i kid, i kid)</p>



<a name="246474539"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246474539" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246474539">(Jul 19 2021 at 16:01)</a>:</h4>
<p>i think unsafe is not perfect but its hard to find an improvement. unsafe leans on having a discouraging connotation, which i think is the right default.</p>
<p>personally, when i started with rust, it was about a year before i used unsafe for the first time (despite being proficient in low level c and c++). admittedly, this is because i figured "what's the point of rust if I'm just going to use unsafe everwhere", which is probably not the right attitude (there are a lot of good reasons to use unsafe, even as a beginner, although our beginner documentation around unsafe is sorely lacking, since we assume we can punt it to advance unsafe docs...) but i think its not too far from the right direction for the average case.</p>



<a name="246489012"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246489012" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246489012">(Jul 19 2021 at 17:55)</a>:</h4>
<p>maybe a good alternative to <code>unsafe</code> is to name <code>unsafe</code> blocks/impls "manually proven blocks": <code>mprove { *ptr }</code> and functions/traits that are <code>unsafe</code> to implement/call: "manual proof required":</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="n">mproofr</span><span class="w"> </span><span class="k">fn</span> <span class="nf">read</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="p">(</span><span class="n">ptr</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="nc">T</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
</code></pre></div>



<a name="246489212"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246489212" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246489212">(Jul 19 2021 at 17:57)</a>:</h4>
<p>having separate keywords for the different use cases would likely reduce confusion.</p>



<a name="246490435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246490435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246490435">(Jul 19 2021 at 18:05)</a>:</h4>
<p>Ha, if we rename <code>unsafe { ... }</code> to <code>theorem { ... }</code> I'm sure that will make people more afraid to use it</p>



<a name="246490535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246490535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246490535">(Jul 19 2021 at 18:06)</a>:</h4>
<p>or perhaps a postfix keyword, <code>{ ... } qed</code></p>



<a name="246490806"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246490806" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246490806">(Jul 19 2021 at 18:07)</a>:</h4>
<p>for unsafe functions I guess it could be something like <code>requires [..]</code> (with an explicit <code>[..]</code> because we're punting on actual syntax for requires clauses)</p>



<a name="246492777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246492777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246492777">(Jul 19 2021 at 18:23)</a>:</h4>
<p><span class="user-mention silent" data-user-id="256342">bstrie</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/New.20Rust-related.20paper/near/246490535">said</a>:</p>
<blockquote>
<p>or perhaps a postfix keyword, <code>{ ... } qed</code></p>
</blockquote>
<p><code>{ ... } ∎</code>, and we could call them <a href="https://en.wikipedia.org/wiki/Tombstone_(typography)">tombstone blocks</a>. :)</p>



<a name="246493048"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246493048" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246493048">(Jul 19 2021 at 18:25)</a>:</h4>
<p>a tombstone block, as in, this is the place you will be buried if you dare to violate memory safety</p>



<a name="246493437"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246493437" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246493437">(Jul 19 2021 at 18:28)</a>:</h4>
<p>or, the place Rust's designers will be buried because they made the syntax impossible to type...</p>



<a name="246495459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New%20Rust-related%20paper/near/246495459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/New.20Rust-related.20paper.html#246495459">(Jul 19 2021 at 18:42)</a>:</h4>
<p><em>Laughs in arbitrary unicode entry</em></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>